PowerSYSTEM Center Authorization and SQL Injection Flaws (CVE-2026-63017)

CVE-2026-63017 and CVE-2026-63774 are two flaws in PowerSYSTEM Center from Subnet Solutions. CISA published them together in ICS advisory ICSA-26-307-01 on 3 November 2026. CISA lists Critical Manufacturing and Energy as the affected sectors, deployed worldwide, with the company based in Canada.

CVE-2026-63017 is incorrect authorization. The record says a low-privileged, authenticated user can access resources normally limited to administrators.

CVE-2026-63774 is insufficient input validation in the report designer, which is an SQL injection flaw (CWE-89). The record says an authenticated user can execute unauthorized SQL commands. CISA summarizes the pair as allowing unauthorized SQL commands and access to unauthorized resources.

What an Attacker Needs

Both records score the attack vector as adjacent network, with low attack complexity, low privileges required and no user interaction. We read this as an attacker who has a valid account and sits on a network segment adjacent to the server. The records give no further technical detail, and we add none. Our SQL injection entry explains the weakness class behind CVE-2026-63774.

How the Scores Read

CISA ICS-CERT, the CNA, scores both flaws CVSS 4.0 9.4 Critical with vector CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. It also scores both CVSS 3.1 9.0 Critical with vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

NVD lists the CNA's scores as secondary and shows both entries as received on 6 November 2026. In both vectors, confidentiality, integrity and availability impact are high. See our CVSS entry for how to read them.

What CISA and KEV Say

As of CISA catalog version 2026.11.04, neither CVE is in the Known Exploited Vulnerabilities catalog. Our KEV glossary entry explains the catalog.

CISA recommends that organizations minimize network exposure of control system devices, so that none is reachable from the internet. It also recommends placing control system networks behind firewalls and isolating them from business networks.

CISA's advisory and the CVE records list three PowerSYSTEM Center product lines. CVE-2026-63017 affects all three. CVE-2026-63774 affects the 2024 and 2026 lines. The update versions and interim measures on this page are Subnet Solutions' guidance as CISA's advisory quotes it.

CISA's web page also shows a 2020 line under CVE-2026-63774 without a remediation. The CVE record and CISA's CSAF file list only the 2024 and 2026 lines for that CVE, and we follow them.

For CVE-2026-63017, Subnet Solutions says that if you cannot update, you should monitor user activity records for acceptable use. It also recommends disabling the ability of Client Access Server users to open the browser's F12 Developer Tools.

For CVE-2026-63774, Subnet Solutions says that if you cannot update, you should disable user access to the report designer. Chinmay Patel of Digital Boundary Group reported the flaws. Our vulnerability management guide covers how to track fixes across product lines.